**Session Date/Time:** 09 Nov 2023 14:00

# CFRG Meeting - IETF 118 Prague

## Summary

The CFRG meeting at IETF 118 in Prague covered updates on several active documents, including VDAF, BBS signatures, AED proxy, and new research on AAD properties and a new Verifiable Distributed Aggregation Function (VDAF) called MasTic.  Discussions also centered on RSA guidance and batch signatures.  Several documents are nearing research group last call.

## Key Discussion Points

*   **VDAF (Verifiable Distributed Aggregation Function):**  Chris presented updates, including optimizations for IDPF, and a move from Shake to Turbo Shake.  The editors are considering a couple of breaking changes. Open issues include IN considerations and editorial work. Simon Fee Program questioned the maturity of Poplar compared to Prio and whether multiple implementations are needed.
*   **BBS Signatures:** Vasilis discussed updates to the draft. The main changes are factoring the draft to separate proof operations and separating main operations into high-level API. He proposed a new proof generation procedure from 2016 SDL. A separate document for blind BBS signatures was proposed. The group asked about specific use cases in mind for blind BBS signatures in the IETF or outside.
*   **AED (Authenticated Encryption with Associated Data) Proxy:** Andre provided an update on the AED proxy draft. Samuel Lucas helped point out that the draft only covered key commitment before and helped provide a roadmap, and he said that it is really interesting that commitment had different applications. Individuality is a topic being worked on but presents challenges as it's an entirely different approach to defining AED security.
*   **Impact of Subtle AAD Differences:** Alex presented research on the impact of subtle AAD differences in protocol security, focusing on automated analysis of protocols and limitations of attacker models.
*   **MasTic (New VDAF):** Dimitris presented MasTic, a new VDAF, focusing on one-hot verifiability and path verifiability to defend against malicious clients.
*   **RSA Guidance:** Norman talked about the blanket duplication of PKCS 1 version 1.5. New improvements to timing side channel epics, recommendation about, most common leakage sources, and about implicit rejection for the KCS 1 version 15.
*   **Batch Signatures:** David introduced a draft on batch signatures using Merkel trees to improve throughput, aiming for a generic solution applicable to various signature algorithms. Feedback was requested.

## Decisions and Action Items

*   **VDAF:** Study the security implications of optimizing IDPF where a little bit of security is sacrificed in more detail.
*   **BBS Signatures:** Discuss whether blind signature functionality should be a separate document or included in the main draft.
*   **RSA Guidance:** Contact the chairs to discuss bringing the draft to an adoption call.

## Next Steps

*   **VDAF:** Editors to continue addressing open issues and seek reviews.
*   **BBS Signatures:** Reviewers need to review the draft after it's updated to include a new proof generation procedure.
*   **AED Proxy:** Andre to continue working on differentiability and incorporating feedback on the draft.
*   **MasTic:** Continue evaluations and full security analysis in a forthcoming paper. The presenters will provide an apples to apples comparison of MasTic vs Poplar.
*   **Batch Signatures:** Refine the draft and gather use cases.
*   **Opaque and CPACE:** Start the resource group plus calls really soon.